topic Re: AAA Accounting Question in Network Access Control

AAA Accounting Question

Alex Pfeil — Mon, 01 Apr 2019 12:41:32 GMT

I have aaa configured with authentication, authorization, and accounting. When I make a change that affects connectivity to the AAA server, I can still add commands to the device. However, there is a significant wait time between executing commands. If I remove aaa accounting, then I can continue to enter commands as normal. Is there a command to decrease the wait time such as a timeout?

Thanks in advance!

Re: AAA Accounting Question

AndreaTornaghi — Mon, 01 Apr 2019 13:35:20 GMT

Dear,

you can try to use the following command:

tacacs-server timeout <seconds>

Re: AAA Accounting Question

Arne Bier — Mon, 01 Apr 2019 21:40:10 GMT

Each accounting packet requires an ACK from the AAA server. I suppose you don't have command authorization enabled or else the whole thing would grind to a halt 😉

Do you have more than one AAA server defined in a Group perhaps? I would have thought having an alternative AAA server would resolve that while Primary server was in maintenance.

Re: AAA Accounting Question

Alex Pfeil — Tue, 02 Apr 2019 20:58:28 GMT

Authorization works because the backup is local. The issue is that the accounting does not have a local backup. So, if the accounting server is not reachable on the network, each command entry will wait for the timeout period (I'm guessing). Should I set the timeout to two seconds?